Overview

overview

10

Static

static

10

622dedc13f...d4.exe

windows7-x64

10

622dedc13f...d4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2024 13:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    622dedc13f5fe868c33c95bfe8c802d9d7741621c0e8807ceb9f6bd2462eabd4.exe

  • Size

    64KB

  • MD5

    f0ffe0d1d9e72ea6773a5c7a8c5c040c

  • SHA1

    33ef1ee668f2ebd52b6cbe5a0baa0565d0a1458b

  • SHA256

    622dedc13f5fe868c33c95bfe8c802d9d7741621c0e8807ceb9f6bd2462eabd4

  • SHA512

    b4bbd963ff0a34e4f1039bf86c0017556d9163f5523d75134ec51772b5033690570fbf4c22cd7a63b199763418bc8440c9d058eff278f0ff440e518c2f2c9992

  • SSDEEP

    1536:Nq7J63PjxRFvRl9OwZJqbuwmC8DltpqKmY7:NqV6lR/rJqbu12z

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_file

    WindowsDefender.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\622dedc13f5fe868c33c95bfe8c802d9d7741621c0e8807ceb9f6bd2462eabd4.exe
    "C:\Users\Admin\AppData\Local\Temp\622dedc13f5fe868c33c95bfe8c802d9d7741621c0e8807ceb9f6bd2462eabd4.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2156-0-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2156-1-0x00000000010F0000-0x0000000001106000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2156-2-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2156-3-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

    Filesize

    9.9MB

    Download